Procedure
Secure Code Review Procedure
This procedure defines how code is reviewed for security defects before merge to a protected branch and before release. It applies to human-authored, AI-assisted, and AI-generated code, and to changes that affect runtime behaviour, dependencies, configuration, infrastructure-as-code, and security-critical components.
- Type
- Procedure
- Version
- 0.0.9
- Date
- 2026-10-27
- Owner
- Chief Information Security Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Developer Security
- Review frequency
- Annual and upon material change to languages, framework stack, or AI-assisted development practice
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Scope
- Procedure
- Reviewer competency and rotation
- Tooling integration
- AI-assisted and AI-generated code
- Operating expectations
- Framework alignment
- Limitations
Frameworks it maps to
- NIST SP 800-218 Version 1.1
- OWASP SAMM
- OWASP ASVS v5
- ISO/IEC 27001:2022
- ISO/IEC 27002:2022
- OpenSSF Best Practices
- SLSA v1.2
- CIS CSC v8.1
Related documents
- Secure Development and Engineering Policydev-security
- Developer Security Requirementsdev-security
- DevOps Security Requirementsdev-security
- Software Composition Analysis Standarddev-security
- API Security Standarddev-security
- Quality Assurance and Testing Standarddev-security
- AI Coding Assistant Security Guidelinedev-security
- Vulnerability Management Proceduresecurity
- AI Security and Risk Standardai
Next
All Documents